3 ms·

Oh, interesting. Are your servers targets of interest somehow? Or are your ports possibly still low numbers?

• dp30 9y ago
  definitely not interesting, but they're on port 8022 so maybe that's a common one for attack scanners. i mean with masscan its so fast and easy to find ssh ports, i cant imagine any non-standard port is more obscure than the next. they are hosted on a low cost vps provider so maybe their ranges are common low hanging fruit.
  • throwaway613834 9y ago
    I wouldn't have revealed the exact port number here, but thanks :) yeah, I think your explanation sounds plausible.
    • firethief 9y ago
      A port number isn't a real secret, it just screens out the bulk of mass scans. There's no point trying to hide it from targeted attackers.
  • user5994461 9y ago
    The hosting providers have known IP ranges and they are scanned permanently. I wouldn't be surprised if some guys had a rule to try 8022 and the most common non standard ports.